CERTIFICATION OF ENROLLMENT ENGROSSED SECOND SUBSTITUTE HOUSE BILL Chapter 151, Laws of st Legislature 2010 Regular Session

Transcription

1 CERTIFICATION OF ENROLLMENT ENGROSSED SECOND SUBSTITUTE HOUSE BILL 1149 Chapter 151, Laws of st Legislature 2010 Regular Session FINANCIAL INFORMATION--SECURITY BREACHES--CREDIT AND DEBIT CARDS EFFECTIVE DATE: 07/01/10 Passed by the House March 6, 2010 Yeas 65 Nays 30 FRANK CHOPP Speaker of the House of Representatives Passed by the Senate March 2, 2010 Yeas 45 Nays 0 BRAD OWEN President of the Senate Approved March 22, 2010, 2:25 p.m. CERTIFICATE I, Barbara Baker, Chief Clerk of the House of Representatives of the State of Washington, do hereby certify that the attached is ENGROSSED SECOND SUBSTITUTE HOUSE BILL 1149 as passed by the House of Representatives and the Senate on the dates hereon set forth. BARBARA BAKER FILED Chief Clerk March 22, 2010 CHRISTINE GREGOIRE Governor of the State of Washington Secretary of State State of Washington

2 ENGROSSED SECOND SUBSTITUTE HOUSE BILL 1149 AS AMENDED BY THE SENATE Passed Legislature Regular Session State of Washington 61st Legislature 2010 Regular Session By House Financial Institutions & Insurance (originally sponsored by Representatives Williams, Roach, Simpson, Kirby, Dunshee, Nelson, and Ormsby) READ FIRST TIME 01/21/10. 1 AN ACT Relating to protecting consumers from breaches of security; 2 adding a new section to chapter RCW; creating new sections; and 3 providing an effective date. 4 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON: 5 NEW SECTION. Sec. 1. The legislature recognizes that data 6 breaches of credit and debit card information contribute to identity 7 theft and fraud and can be costly to consumers. The legislature also 8 recognizes that when a breach occurs, remedial measures such as 9 reissuance of credit or debit cards affected by the breach can help to 10 reduce the incidence of identity theft and associated costs to 11 consumers. Accordingly, the legislature intends to encourage financial 12 institutions to reissue credit and debit cards to consumers when 13 appropriate, and to permit financial institutions to recoup data breach 14 costs associated with the reissuance from large businesses and card 15 processors who are negligent in maintaining or transmitting card data. 16 NEW SECTION. Sec. 2. A new section is added to chapter RCW 17 to read as follows: 18 (1) For purposes of this section: p. 1 E2SHB 1149.SL

3 1 (a) "Account information" means: (i) The full, unencrypted 2 magnetic stripe of a credit card or debit card; (ii) the full, 3 unencrypted account information contained on an identification device 4 as defined under RCW ; or (iii) the unencrypted primary 5 account number on a credit card or debit card or identification device, 6 plus any of the following if not encrypted: Cardholder name, 7 expiration date, or service code. 8 (b) "Breach" has the same meaning as "breach of the security of the 9 system" in RCW (c) "Business" means an individual, partnership, corporation, 11 association, organization, government entity, or any other legal or 12 commercial entity that processes more than six million credit card and 13 debit card transactions annually, and who provides, offers, or sells 14 goods or services to persons who are residents of Washington. 15 (d) "Credit card" has the same meaning as in RCW 9A (e) "Debit card" has the same meaning as in RCW 9A and for 17 the purposes of this section, includes a payroll debit card. 18 (f) "Encrypted" means enciphered or encoded using standards 19 reasonable for the breached business or processor taking into account 20 the business or processor's size and the number of transactions 21 processed annually. 22 (g) "Financial institution" has the same meaning as in RCW (h) "Processor" means an individual, partnership, corporation, 25 association, organization, government entity, or any other legal or 26 commercial entity, other than a business as defined under this section, 27 that directly processes or transmits account information for or on 28 behalf of another person as part of a payment processing service. 29 (i) "Service code" means the three or four digit number in the 30 magnetic stripe or on a credit card or debit card that is used to 31 specify acceptance requirements or to validate the card. 32 (j) "Vendor" means an individual, partnership, corporation, 33 association, organization, government entity, or any other legal or 34 commercial entity that manufactures and sells software or equipment 35 that is designed to process, transmit, or store account information or 36 that maintains account information that it does not own. 37 (2) Processors, businesses, and vendors are not liable under this 38 section if (a) the account information was encrypted at the time of the E2SHB 1149.SL p. 2

4 1 breach, or (b) the processor, business, or vendor was certified 2 compliant with the payment card industry data security standards 3 adopted by the payment card industry security standards council, and in 4 force at the time of the breach. A processor, business, or vendor will 5 be considered compliant, if its payment card industry data security 6 compliance was validated by an annual security assessment, and if this 7 assessment took place no more than one year prior to the time of the 8 breach. For the purposes of this subsection (2), a processor, 9 business, or vendor's security assessment of compliance is 10 nonrevocable. The nonrevocability of a processor, business, or 11 vendor's security assessment of compliance is only for the purpose of 12 determining a processor, business, or vendor's liability under this 13 subsection (2). 14 (3)(a) If a processor or business fails to take reasonable care to 15 guard against unauthorized access to account information that is in the 16 possession or under the control of the business or processor, and the 17 failure is found to be the proximate cause of a breach, the processor 18 or business is liable to a financial institution for reimbursement of 19 reasonable actual costs related to the reissuance of credit cards and 20 debit cards that are incurred by the financial institution to mitigate 21 potential current or future damages to its credit card and debit card 22 holders that reside in the state of Washington as a consequence of the 23 breach, even if the financial institution has not suffered a physical 24 injury in connection with the breach. In any legal action brought 25 pursuant to this subsection, the prevailing party is entitled to 26 recover its reasonable attorneys' fees and costs incurred in connection 27 with the legal action. 28 (b) A vendor, instead of a processor or business, is liable to a 29 financial institution for the damages described in (a) of this 30 subsection to the extent that the damages were proximately caused by 31 the vendor's negligence and if the claim is not limited or foreclosed 32 by another provision of law or by a contract to which the financial 33 institution is a party. 34 (4) Nothing in this section may be construed as preventing or 35 foreclosing any entity responsible for handling account information on 36 behalf of a business or processor from being made a party to an action 37 under this section. p. 3 E2SHB 1149.SL

5 1 (5) Nothing in this section may be construed as preventing or 2 foreclosing a processor, business, or vendor from asserting any defense 3 otherwise available to it in an action including, but not limited to, 4 defenses of contract, or of contributory or comparative negligence. 5 (6) In cases to which this section applies, the trier of fact shall 6 determine the percentage of the total fault which is attributable to 7 every entity which was the proximate cause of the claimant's damages. 8 (7) The remedies under this section are cumulative and do not 9 restrict any other right or remedy otherwise available under law, 10 however a trier of fact may reduce damages awarded to a financial 11 institution by any amount the financial institution recovers from a 12 credit card company in connection with the breach, for costs associated 13 with access card reissuance. 14 NEW SECTION. Sec. 3. This act takes effect July 1, NEW SECTION. Sec. 4. This act applies prospectively only. This 16 act applies to any breach occurring on or after the effective date of 17 this section. Passed by the House March 6, Passed by the Senate March 2, Approved by the Governor March 22, Filed in Office of Secretary of State March 22, E2SHB 1149.SL p. 4